Need help with "find"

[Branson R. Rasko]

Hello all,

I need some help with the "find" utility. I want to create a script for viewing files that have been accessed within a certain time frame. More specifically I want to be able to insert a Beginning time and an ending time and have the script return to screen any files that have been accessed between the two time variables. I know this will have to do with the -atime option, but I'm not up to snuff on what and how variables are passed to -atime. Any help would be greatly appreciated.

Branson R. Rasko

[Jeff Schussele]

Hi Branson,

Well, I've never tried this, but from what i gather from the man pgs - you won't be able to get any finer granularity from the find command than days.

I think it would be something like:

find . -atime -3 -newera file_touched_7days_ago

This would indicate any files accessed beteween 3 & 7 days.

For ease of use it might be quite easier to use Clay's date hammer - caljd.sh/pl

Search for caljd, it'll pop out at you.

Rgds,
Jeff

[Wodisch]

Hi Branso,

have you considered using GNU time?

Regards,
Wodisch

[Jean-Louis Phelix]

hi,

There was a post yesterday on same subject.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xcb610fe6d0f7d61190050090279cd0f9,00.html

The complete syntax from the man page states :

In the descriptions of the primaries, the argument n represents a decimal integer; +n means more than n, -n means less than n, and n means exactly n.

so :

3 days old --> -mtime 3
more than 3 days old --> -mtime +3
less than 3 days old --> -mtime -3

You can also have multiple -atime. In your case, it could be :

find . -atime +3 -atime -7

to get files accessed between 3 and 7 days. But the mtime is often more pertinent.

Regards.

Regards

[Christian Gebhardt]

Hi
there was a posting some days ago
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x31d5cdec06f1d61190050090279cd0f9,00.html

You can use procura's perl script

Chris

[James R. Ferguson]

Hi:

'find' can to this quite easily without resorting to anything else!

Consider finding files modified between 11/11/2002 and 11/21/2002. By example:

# cd /tmp
# touch -mt 11110000 ref1
# touch -mt 11210800 ref2
# find . \( -type f -a -newer /tmp/ref1 -a ! -newer /tmp/ref2 \) |xargs ls -l {}

Have a look at the man pages. The '-a' is a logical "and". The two "ref" files establish the bounds of time in which to look.

Regards!

...JRF...

[W.C. Epperson]

Be aware that "find" itself restamps the atime on directories, and that most backup solutions restamp the atime on files when they're backed up. I've always found it difficult to use atime effectively because of this.